Default Sandbox access situation with regards to users

Question

So when a Sandbox is refreshed or created, everyone's email gets changed so that it has .invalid on the end.

This seems to have the useful side effect of stopping users from logging in - when they first try to access the sandbox, Salesforce tries to email them a verification code and they can't get the email, so they can't log in until and admin corrects their email address.

In terms of sandbox security (particularly full copy sandboxes) this seems quite useful.

My question is: Is this a hard and fast rule that I can rely on - that users wont be able to log into a fresh sandbox unless someone fixes their email address - or are there some situations when a verification code is not required and hence users can get straight into a sandbox.

In short, I need to know if this is an 'official' feature or just some happy accident that depends on other security settings around verification codes. I'm writing something about sandbox security and need to know how reliable this is ....

Answer 1

You should assume that any given user will have a decent chance of logging in unless they are frozen/disabled/intentionally locked out via a script. If the user has a production password, and they know what it was at the time of creation/refresh, they can use that password. From there, if they've logged in from that IP address recently, they often won't be challenged; alternatively, if they are coming from a whitelisted IP or an IP within their Login IP Restriction settings, they won't be challenged. Even if they are challenged, if they have set up mobile/SMS verification, they can still use that method to log in. Unless an administrator takes active steps to prevent users from logging in, there's no reason to believe that users cannot log in as long as they meet certain criteria.